MAL-2026-18103

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semverr/MAL-2026-18103.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18103
Published
2026-10-20T18:20:18Z
Modified
2026-10-20T19:30:08Z
Summary
Malicious code in semverr (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (110e0a64dd80654ca98caa5e291499d158a39eb66c1d35efe896a42095c85118)

semverr is a near-empty package (a one-line version) whose name resembles the popular semver library. Its setup.py runs at install time (invoked by pip during pip install) and calls urllib.request.urlretrieve to fetch an opaque binary from https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd, writes it to a PID-suffixed path in the system temp directory, and launches it via subprocess.Popen with start_new_session=True and stdout/stderr redirected to DEVNULL so the detached child survives the install and runs silently. The fetch is unpinned, unverified (no hash or signature check), and directed at an anonymous Cloudflare Workers host unrelated to any declared publisher. Exceptions in the fetch/exec path are swallowed so install still appears to succeed. The package has no other functionality.

Source: kam193 (0f1ce7737886cf79e2762db6431449cafab516651f2163e202faaf449a139ecb)

During installation, package downloads and executes malware.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-semvver

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • malware

  • typosquatting

Database specific 
{
    "iocs":  {
        "domains":  [
            "c2-worker.crawlnet-claim.workers.dev"
        ],
        "urls":  [
            "https://c2-worker.crawlnet-claim.workers.dev/dl/pyupd"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-021534",
            "import_time":  "2026-10-20T18:22:19.73066709Z",
            "modified_time":  "2026-10-20T18:20:18Z",
            "sha256":  "110e0a64dd80654ca98caa5e291499d158a39eb66c1d35efe896a42095c85118",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "pypi/2026-10-semvver/semverr",
            "import_time":  "2026-10-20T19:15:26.420761428Z",
            "modified_time":  "2026-10-20T18:28:24.555451Z",
            "sha256":  "0f1ce7737886cf79e2762db6431449cafab516651f2163e202faaf449a139ecb",
            "source":  "kam193",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / semverr

Package

Name
semverr
View open source insights on deps.dev
Purl
pkg:pypi/semverr

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "143c4e3a6ef216b21d97d3b7b0a79fba5e58f19256f3e99d43bec94a12b144b6",
            "tlsh":  "75f0c052c517662682c2c231ee2204622ff79603db93d8f4399c53546fcd87a8155a09"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "semverr-1.0.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "31277f95a999f2da5839f3a9a0853ff7f79a4e901d0c1263e36ec3681c07f7c2",
                "md5":  "ac71eaeafc6805191a068d426afd4e3a",
                "sha256":  "d0ed785081f4955f30f648636988793673d3b8315ecfe736b1e9d8505145f925"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/semverr/MAL-2026-18103.json"